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THE REPLY FILED 09 June 2009 FAILS TO PLACE THIS APPLICATION IN CONDITION FOR ALLOWANCE. 

1 . £3 The reply was filed after a final rejection, but prior to or on the same day as filing a Notice of Appeal. To avoid abandonment of this 

application, applicant must timely file one of the following replies: (1 ) an amendment, affidavit, or other evidence, which places the 
application in condition for allowance; (2) a Notice of Appeal (with appeal fee) in compliance with 37 CFR 41 .31 ; or (3) a Request 
for Continued Examination (RCE) in compliance with 37 CFR 1.114. The reply must be filed within one of the following time 
periods: 

a) K| The period for reply expires 3_months from the mailing date of the final rejection. 

b) CD The period for reply expires on: (1) the mailing date of this Advisory Action, or (2) the date set forth in the final rejection, whichever is later. In 

no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of the final rejection. 

Examiner Note: If box 1 is checked, check either box (a) or (b). ONLY CHECK BOX (b) WHEN THE FIRST REPLY WAS FILED WITHIN TWO 

MONTHS OF THE FINAL REJECTION. See MPEP 706.07(f). 
Extensions of time may be obtained under 37 CFR 1 .136(a). The date on which the petition under 37 CFR 1.136(a) and the appropriate extension fee 
have been filed is the date for purposes of determining the period of extension and the corresponding amount of the fee. The appropriate extension fee 
under 37 CFR 1.17(a) is calculated from: (1) the expiration date of the shortened statutory period for reply originally set in the final Office action; or (2) as 
set forth in (b) above, if checked. Any reply received by the Office later than three months after the mailing date of the final rejection, even if timely filed, 
may reduce any earned patent term adjustment. See 37 CFR 1 .704(b). 
NOTICE OF APPEAL 

2. □ The Notice of Appeal was filed on . A brief in compliance with 37 CFR 41 .37 must be filed within two months of the date of 

filing the Notice of Appeal (37 CFR 41 .37(a)), or any extension thereof (37 CFR 41 .37(e)), to avoid dismissal of the appeal. Since a 
Notice of Appeal has been filed, any reply must be filed within the time period set forth in 37 CFR 41.37(a). 
AMENDMENTS 

3. □ The proposed amendment(s) filed after a final rejection, but prior to the date of filing a brief, will not be entered because 

(a)HH They raise new issues that would require further consideration and/or search (see NOTE below); 
{b)\Z\ They raise the issue of new matter (see NOTE below); 

(c) □ They are not deemed to place the application in better form for appeal by materially reducing or simplifying the issues for 

appeal; and/or 

(d) Q They present additional claims without canceling a corresponding number of finally rejected claims. 

NOTE: . (See 37 CFR 1.1 16 and 41.33(a)). 

4. □ The amendments are not in compliance with 37 CFR 1.121. See attached Notice of Non-Compliant Amendment (PTOL-324). 

5. n Applicant's reply has overcome the following rejection(s): . 

6. □ Newly proposed or amended claim(s) would be allowable if submitted in a separate, timely filed amendment canceling the 

non-allowable claim(s). 

7. □ For purposes of appeal, the proposed amendment(s): a) □ will not be entered, or b) □ will be entered and an explanation of 

how the new or amended claims would be rejected is provided below or appended. 
The status of the claim(s) is (or will be) as follows: 

Claim(s) allowed: . 

Claim(s) objected to: . 

Claim(s) rejected: . 

Claim(s) withdrawn from consideration: . 

AFFIDAVIT OR OTHER EVIDENCE 

8. □ The affidavit or other evidence filed after a final action, but before or on the date of filing a Notice of Appeal will not be entered 

because applicant failed to provide a showing of good and sufficient reasons why the affidavit or other evidence is necessary and 
was not earlier presented. See 37 CFR 1.116(e). 

9. □ The affidavit or other evidence filed after the date of filing a Notice of Appeal, but prior to the date of filing a brief, will not be 

entered because the affidavit or other evidence failed to overcome all rejections under appeal and/or appellant fails to provide a 
showing a good and sufficient reasons why it is necessary and was not earlier presented. See 37 CFR 41 .33(d)(1 ). 

1 0. □ The affidavit or other evidence is entered. An explanation of the status of the claims after entry is below or attached. 
REQUEST FOR RECONSIDERATION/OTHER 

11. The request for reconsideration has been considered but does NOT place the application in condition for allowance because: 
See Attached Continuation Sheet. 

12. □ Note the attached Information Disclosure Statements). (PTO/SB/08) Paper No(s). 

13. □ Other: . 

/Edan Orgad/ 

Supervisory Patent Examiner, Art Unit 2439 
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Continuation of 1 1 . Note: 

Examiner respectfully disagrees with Applicant's argument for independent claiml and other similar independent claims 49, 50, and 62 that 
Joyce (US Patent 6,519,703) lacks a teaching or suggestion that the firewall forwards packets to a virus scanning engine since the packets 
stay within the firewall, and Fink (US Patent 6,496,935) does not cure this deficiency. The forwarding process disclosed by Joyce starts 
with the heuristic stage analysis, which rates the incoming packet stream with different rating (see lines 41-57, Col. 2 and lines 39-58, Col. 3 
from Joyce). This is equivalent to the claimed classifying step. In fact, the teaching from Joyce specifically discloses that the packet 
stream is classified into "high-confidence" one, which does not contain threat/virus (lines 38-43, Col. 3 and lines 37-43, Col. 4 from Joyce) 
and into "marginal-confidenceTpoor confidence" one, which can contain threats/virus (see lines 48-58, Col. 3 and lines 37-43, Col. 4 from 
Joyce). The forwarding process of the "high-confidence" packet (i.e., the claimed first type), according to Joyce, would transmit the packet 
out to a network (i.e., destination) (see lines 9-10 and 38-43, Col. 3 and Fig. 2 from Joyce), and the forwarding process to the "marginal- 
confidence" one (i.e., the claimed second type) would transmit to a complex rule base module for additional processing/scanning (see lines 
54-57, Col. 3 from Joyce). Thus, based on the teaching from Joyce, it is believed that the claimed forwarding process from one 
entity/module (heuristic module) to another entity/module (complex rule base) or destination has been met with, and the rejections of 
independent claiml and other similar independent claims 49, 50, and 62, based on the combination of Fink in view of Joyce, are to be 
maintained. 

Examiner respectfully disagrees to Applicant's argument for the dependent claims 4 and 58. Examiner has specifically pointed out that the 
claimed limitation is rejected based on the teaching by Joyce in lines 1-5 of the Abstract and lines 32-39 of Col. 3. That is, the packet 
streams are of "real" time data in associated with the traffic session (see lines 34-39, Col. 4 from Joyce) from and are analyzed by the 
system taught by Joyce. In addition, Applicant is further notified that the term, "real-time", is vastly broad that can be referenced/applied to 
any ongoing traffic conducted in a communication system. Therefore, the packet stream for the session traffic in the example stated in 
Joyce meets with the argued claim limitation. 

The rejections of the dependent claims 5, 57, 59, and 63-64 are maintained based on the reason stated in the previous paragraph. In 
addition, Lee (US patent 7,047,561) teaches the packet contents are of video and audio (see lines 58-62, col. 1 and lines 36-39, Col. 5 from 
Lee). Thus, the combination of Fink and Joyce in view of Lee has sufficiently address the limitation regarding the real-time video or audio 
packet. 

Lastly, Examiner respectfully disagrees with Applicant's assertion that the combination of Fink and Joyce presented in the Office Action is 
merely based on an application of impermissible hindsight reconstruction in piecing together the prior art references using Applicant's 
Specification as a blue print to arrive the combination. Applicant is reminded that it must be recognized that any judgment on obviousness 
is in a sense necessarily a reconstruction based upon hindsight reasoning. But so long as it takes into account only knowledge which was 
within the level of ordinary skill at the time the claimed invention was made, and does not include knowledge glean only from the applicant's 
disclosure, such reconstruction is proper. In re McLaughlin, 443 F.2d 1392; 170 USPQ 209 (CCPA 1971). In this case, the combination of 
Fink and Joyce in view of Lee is made within the level of ordinary skill at the time the claimed invention was made as the motivation to 
combine the prior art references is to specifically provide real-time "internet" application (see lines 7-8, Col. 1 from Lee) security while 
providing necessary speed (see lines 15-17, Col. 2 from Lee). 
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